github.com/nezhahq/nezha
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- affected by 7 advisory(ies)
Advisories (33)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-39g2-8x68-pmx8 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context | 2.0.14 – < 2.1.0 | Undetermined |
| GHSA-4g6j-g789-rghm Nezha's authenticated agents can forge service-monitor results for other users' services | 0.20.0 – < 1.14.15-0.20260521020202-02129f16fb15 ; 2.0.0 – < 2.0.12 | Undetermined |
| GHSA-5c25-7vpj-9mqh Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key | < 2.0.13 | Undetermined |
| GHSA-6x26-5727-rrm9 Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host | 0.20.0 – < 2.0.10 | Undetermined |
| GHSA-8qhj-4f8c-j8qg Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents | 1.0.0 – < 2.0.14 | Undetermined |
| GHSA-99gv-2m7h-3hh9 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron | 1.4.0 – < 1.14.15-0.20260517022419-d7526351cf97 | Undetermined |
| GHSA-9rc6-8cjv-rcvx Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection | 1.0.0 – < 2.2.0 | Undetermined |
| GHSA-hvv7-hfrh-7gxj Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members | 1.4.0 – < 1.14.15-0.20260517034128-05e5da253519 | Undetermined |
| GHSA-jg62-j5h6-8mpq Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS | 1.0.0 – < 2.2.0 | Undetermined |
| GHSA-q6xx-5vr8-p898 Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check | 1.14.13 – 1.14.14 ; 2.0.0 – < 2.0.10 | Undetermined |
| GHSA-qjpp-gffx-2wm9 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant | 0.0.0-20260628010923-fd31e5f1b0f8 – < 0.0.0-20260721131105-c893aa57867d | Undetermined |
| GHSA-rf68-8gjr-36q7 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty | 2.2.3 | Not affected |
| GHSA-rxf6-wjh4-jfj6 Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) | 1.4.0 – < 1.14.15-0.20260517022419-d7526351cf97 | Undetermined |
| GHSA-vrmh-5mmx-hjwx Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data | 2.0.0 – < 2.0.14 | Undetermined |
| GHSA-w4g9-mxgg-j532 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification | 1.4.0 – < 1.14.15-0.20260517022419-d06d539d34c1 | Undetermined |
| GHSA-ww5p-j6cj-6mqq Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API | < 2.2.5 | Undetermined |
| GHSA-x6fg-52vr-hj4w Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing | 2.0.14 – < 2.1.0 | Undetermined |
| GO-2026-5119 Nezha's authenticated agents can forge service-monitor results for other users' services in github.com/nezhahq/nezha | 1.0.0 – < 1.14.15-0.20260521020202-02129f16fb15 | Undetermined |
| GO-2026-5261 Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents in github.com/nezhahq/nezha | ≥ 1.0.0 | Undetermined |
| GO-2026-5282 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron in github.com/nezhahq/nezha | 1.4.0 – < 1.14.15-0.20260517022419-d7526351cf97 | Undetermined |
| GO-2026-5439 Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members in github.com/nezhahq/nezha | 1.4.0 – < 1.14.15-0.20260517034128-05e5da253519 | Undetermined |
| GO-2026-5645 Nezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check) in github.com/nezhahq/nezha | 1.4.0 – < 1.14.15-0.20260517022419-d7526351cf97 | Undetermined |
| GO-2026-5672 Nezha's private services (`EnableShowInService: false`) are enumerable via per-server endpoints, leaking name and timing data in github.com/nezhahq/nezha | * | Affected |
| GO-2026-5687 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification in github.com/nezhahq/nezha | 1.4.0 – < 1.14.15-0.20260517022419-d06d539d34c1 | Undetermined |
| GO-2026-5821 Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check in github.com/nezhahq/nezha | * ; ≥ 1.14.13 | Affected |
| GO-2026-5824 Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing in github.com/nezhahq/nezha | * | Affected |
| GO-2026-5826 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context in github.com/nezhahq/nezha | * | Affected |
| GO-2026-5828 Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_key in github.com/nezhahq/nezha | * | Affected |
| GO-2026-5829 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection in github.com/nezhahq/nezha | ≥ 1.0.0 | Undetermined |
| GO-2026-5831 Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS in github.com/nezhahq/nezha | ≥ 1.0.0 | Undetermined |
| GO-2026-5832 Nezha Dashboard: DDNS and Notification credential exposure via unredacted list API in github.com/nezhahq/nezha | * | Affected |
| GO-2026-6486 Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha | * | Affected |
| GO-2026-6794 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha | 0.0.0-20260628010923-fd31e5f1b0f8 – < 0.0.0-20260721131105-c893aa57867d | Undetermined |
Sources
| Source | Licence |
|---|